Data centers may include multiple hosts where the hosts, in turn, each execute multiple virtual machines (VMs). The VMs may belong to virtual layer-2 segments that span across a physical layer-3 data center network using an overlay technology. Based on a design of the data center and/or requirements of the applications executing on the VMs, data centers may limit/restrict private connectivity between hosts or communication between the VMs to maintain security and performance of the data center. When using the overlay technology, VMs in different layer-2 segments may not be able to communicate, i.e., a VM in the data center may not be able to communicate with (e.g., transmit packets to) another VM in the data center.